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What is claimed is: 

1 1 .\. A computer-implemented method for dynamic instrumentation of an executable 

2 application p*QCTam using an instrumentation program, the application program 

3 including a pluralitybf^jriginal functions, each original function having an entry point 

4 and an endpoint, comprising 

5 creating a shared memory > &Qgment for the instrumentation program and the 

6 application program; 

7 upon initial invocation of the originaFfiuictions in the application program, 

8 creating in the shared memory segment corresponding substitute functions including 

9 instrumentation code; and 

10 executing the substitute functions in lieu of the originjiH^unctions in the 

1 1 application program. 
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The method of claim l^turtnpf comprising: 

patching the function entry foo$k$^rfim breakpoint instructions; and 
creating the substitute functions uponfencountering the breakpoint instructions. 



3. The method of claim 2, further comprising replacing the break instruction at the 

2 entry points o^the functions in the application program with branch instructions that 

3 target the substitute functions. 

1 4. The method of claim 3, wherein the executable application program includes 

2 one or more branch instructions having target addresses that reference entry points of 

3 one or more of the original functions, further comprising: 

4 after creating a substitute fiinctkm corresponding to an original function, for a 

5 branch instruction that references the original function replacing the target addresses to 

6 reference the substitute function. 



1 5. The method of claim 1, wherein the executabte^application program includes 

2 one or more branch instructions having target addresses ma^ reference entry points of 

3 one or more of the original functions, further comprising: 
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after creating a substitute function corresponding to an original function, for a 

5 branch instruction that references the original function replacing the target addresses to 

6 reference the substitute function. 

1 6. The method of claim 1, further comprising: 

2 copying ^segment of the executable application program to selected area of 

3 memory by the insVumentation program; 

4 replacing th^segment of the application program with code that allocates the 

5 shared memory by th^instrumentation program; 

6 executing the co&e in the application program that allocates the shared memory 

7 segment; and \ 

8 restoring the segment of the executable application from the selected area of 

9 memory to the application program by the instrumentation program after the shared 
10 memory is allocated. \ 

1 7. The method of claim 6, further comprising: 

2 patching the function entry Voints with breakpoint instructions; and 

3 creating the substitute functions upon encountering the breakpoint instructions. 

1 8. The method of claim 7, further comprising replacing the break instruction at the 

2 entry points of the functions in the application program with branch instructions that 

3 target the substitute functions. \ 

1 9. The method of claim 8, wherein the executable application program includes 

2 one or more branch instructions having target aMdresses that reference entry points of 

3 one or more of the original functions, further corrtorising: 

4 after creating a substitute function corresponding to an original function, for a 

5 branch instruction that references the original function replacing the target addresses to 

6 reference the substitute function. \ 




1 10. The method of claim 6, wherein the executable application program includes 

2 one or more branch instructions having target addresses that\eference entry points of 

3 one or more of the original functions, further comprising: 
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*S after creating a substitute function corresponding to an original function, for a 

branch instruction that references the original function replacing the target addresses to 

6 reference the substitute function. 

1 11. The method of claim 6, wherein the executable application program includes a 

2 plurality of threads and further comprising: 

3 before tMe step of copying the segment of the executable application program 

4 suspending all threads of the executable application program, and selecting one of the 

5 suspended threads;Wd 

6 after replacing the segment of the executable application program with the code 

7 that allocates the shared memory, resuming execution of the one of the suspended 

8 threads at the code that allocates the shared memory. 

1 12. The method of clairA 1 1 , further comprising: 

2 patching the function dntry points with breakpoint instructions; and 

3 creating the substitute functions upon encountering the breakpoint instructions. 

1 13. The method of claim 12, furaier comprising replacing the break instruction at 

2 the entry points of the functions in the* application program with branch instructions 

3 that target the substitute functions. \ 

1 14. The method of claim 13, wherein tne executable application program includes 

2 one or more branch instructions having target addresses that reference entry points of 

3 one or more of the original functions, further comprising: 

4 after creating a substitute function corresponding to an original function, for a 

5 branch instruction that references the original function replacing the target addresses to 

6 reference the substitute function. \ 

1 15. An apparatus for dynamic instrumentation of aivexecutable application program 

2 by an instrumentation program, the application program including a plurality of original 

3 functions, each original function having an entry point andVi endpoint, comprising: 

4 means for creating a shared memory segment for the instrumentation program 

5 and the application program; \ 
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means for creating in the shared memory segment corresponding substitute 
functionsinclttdkigjnsta^imentation code upon initial invocation of the original 
functions in the applicationpr5grani; and 

means for executing the substitute fuitetkois^in lieu of the original functions in 
the application program. 
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